RADIUS Accounting-based Session Creation
Feature Description
- Overview
  - RADIUS Accounting-based Session Creation
- Relationship to Other Features
How RADIUS Accounting-based Session Creation Works
Configuring RADIUS Accounting-based Session Creation
- Enabling RADIUS Accounting-based Session Creation Trigger
- Configuring Access Type and UE Address
Monitoring and Troubleshooting RADIUS Accounting-based Session Creation
- RADIUS Accounting-based Session Creation Show Command(s) and/or Outputs
- RADIUS Accounting-based Session Creation Bulk Statistics

RADIUS Accounting-based Session Creation

This feature enables the SaMOG Gateway to create sessions on receiving a RADIUS Accounting-Start messages for subscribers.

The following sections provide more detailed information:

Feature Description

Overview

The SaMOG Gateway can create sessions based on either of the following messages as a trigger:

RADIUS Access-Request messages: The Access Points (AP) or WLCs are configured with the SaMOG Gateway acting as the AAA Server. When the subscriber's user equipment (UE) performs an 802.11 association, these APs or WLCs trigger a RADIUS Access-Request message towards the SaMOG Gateway.

DHCP messages: The AP or WLC forwards DHCP messages (DHCP discover or DHCP Request) from the UE to the SaMOG Gateway over the EoGRE tunnel. The SaMOG Gateway uses this DHCP message as a trigger to initiate a session. This method of session creation is suited in networks where the AP or WLC is not capable of forwarding RADIUS messages.

RADIUS Accounting-based Session Creation

With the RADIUS Accounting-based Session Creation feature, sessions can be created when the APs forward a RADIUS Accounting-Start message with the allocated UE's IP address towards the accounting server. This method of session creation is suited in networks where the APs do not have EoGRE capabilities. These APs are configured with DHCP servers and the UE's IP address is allocated locally by the AP.

The SaMOG Gateway performs RADIUS-based authentication towards 3GPP AAA server by mapping parameters received in RADIUS Accounting request from the AP to a RADIUS Access-Request message towards the AAA server. The SaMOG Gateway perform APN-based local offload, using a Local P-GW for all accounting triggered sessions. The local P-GW allocates an IP address for the session. SaMOG performs a static NAT between the UE's IP address (shared by the AP in the Framed-IP-Address attribute of the accounting message) and the IP address assigned by the local P-GW.

Relationship to Other Features

DHCP Triggered and RADIUS (Authentication)-based Session Creation

DHCP triggered and RADIUS (authentication) triggered sessions can co-exist with the RADIUS Accounting-based sessions if the AP initiating the sessions are on different TWAN profiles. These TWAN profiles must have a corresponding session trigger configured.

Session Recovery

The RADIUS Accounting-based sessions can be recovered for both unplanned failures and planned migrations.

Web Authorization

The SaMOG Gateway supports RADIUS Accounting-based session creation on the TAL phase of both Web Authorization and Optimized Web Authorization features. Session redirection is performed using the local P-GW.

How RADIUS Accounting-based Session Creation Works

Architecture

The following figure provides the deployment architecture for RADIUS Accounting-based session creation:

Figure 1. RADIUS Accounting-based Session Creation

The following are the sequence of events for a RADIUS Accounting-based session creation deployment model:

The AP allocates an IP address from a local DHCP server. SaMOG acts as an Accounting server for the AP.
Once the IP address is allocated, the AP sends an Accounting Start message to SaMOG with the allocated IP address in the Framed-IP-Address attribute.
SaMOG accepts the Radius Accounting Start message as a session trigger and performs authentication with a 3GPP AAA server.
The AAA server sends the UE details (received in the Accounting message) to the PCRF, and also forwards the NAI information to SaMOG based on the UE location.
On successful authentication, SaMOG establishes a connection with the local P-GW using PMIPv6 control protocol and obtains the IP address.
SaMOG uses the NAI information received from the AAA server in the PMIPv6 PBU message. This information is used by the local P-GW in the Gx messaging towards PCRF during session creation.
The local P-GW sends the redirection rules and other policies to the local P-GW based on the NAI information.
Once the session with the local P-GW is successfully established, SaMOG installs a static NAT between the UE’s IP address and the IP address provided by the local P-GW.
SaMOG can now respond to Accounting Start messages, and the UE starts sending data over L3IP access towards SaMOG.
This data then NATTed towards the local P-GW and routed to the internet or redirected by the local P-GW as per the installed policy.
The downlink data is sent to SaMOG by the local P-GW and a reverse NAT is performed before forwarding the packets to the AP.

Flows

Session Establishment

The figure below shows the detailed session establishment flow for a RADIUS accounting-based session. The table that follows the figure describes each step in the flow.

Table 1. RADIUS Accounting-based Session Establishment
Step	Description
01	UE performs 802.11 association with the AP and attaches to the open SSID.
02	UE sends DHCP Discover message to AP to get an IP address.
03	AP gets an IP address (For example, IP1) from a local DHCP server.
04	AP completes the DHCP transaction with the UE, and sends the IP (IP1) address to the UE in the DHCP offer/DHCP Reply message.
05	AP sends a Radius Accounting Start message to SaMOG with the following parameters: UE MAC address in the Username and Calling Station-Id attribute. Optional: VLAN ID in the NAS-Identifier attribute. IP address (allocated by local DHCP server: IP1) in the Framed-IP-Address attribute. AP-MAC and SSID in the Called-Station-Id attribute.
06	SaMOG caches the Accounting Start message and maps its contents to the Radius Access-Request message towards a AAA server. The Framed-IP-Address received in Accounting Start message is not sent towards the AAA server and the AP IP address (Radius endpoint address/source address of the Accounting Start message) is included in NAS-Port-Id attribute of the Access-Request. The AAA server determines that the UE MAC is not authenticated and sends Access-Accept message with an access point name (APN) and NAI in the MAC@realm format. These values are received using CS-AVPair attributes similar to DHCP triggered sessions.
07	SaMOG initiates a PMIPv6 Proxy Binding Update (PBU) message towards the local P-GW to setup the network side of the call. The MNID of the PBU is the NAI received from the AAA server.
08	The local P-GW sends CCR-I towards the PCRF, and includes the NAI/MNID received from SaMOG in the PBU message.
09	PCRF determines that the subscriber is not authenticated and sends a CCA-I with the L7 redirection rulebase name.
10	The local P-GW installs the L7 redirection rule and proceeds with session creation.
11	The local P-GW allocates an IP address (For example, IP2) for the UE and sends the IP address in the Proxy Binding Answer (PBA) message towards SaMOG.
12	SaMOG maps the static NAT between the IP address (IP1) received in the Accounting Start message from AP, and the IP address (IP2) sent by the local P-GW to the NAT table.
13	SaMOG completes session creation by sending the Accounting Response message to the AP.
14	The local P-GW sends an Accounting Start message towards the AAA server with the UE MAC and the Framed-IP-Address (with IP2).
15	The AAA server sends an Accounting Start response to the local P-GW.
16	The UE attempts to access the HTTP page, and the HTTP packet reaches the local P-GW through SaMOG. SaMOG performs static NAT to change the source IP address of the packet from IP1 to IP2 and forwards it to the local P-GW over the GRE tunnel.
17	As the L7 redirection rule on the local P-GW is active, HTTP packet is intercepted.
18	The local P-GW responds with a HTTP 302 response, and provides the URL of the authentication portal to the UE. SaMOG performs reverse NAT on this packet before forwarding it to the UE.
19	UE sends the HTTP GET request to the portal through SaMOG and the local P-GW.
20	The portal presents the login page to the UE to enter the username and password.
21	The subscriber enters the username and password to perform web authentication.
22	The portal shares the username, password and the source IP address (IP2) of the packet to the PCRF.
23	The PCRF validates the user credentials and marks the UE MAC corresponding to IP2 as authenticated.
24	The PCRF indicates authentication success to the portal. The portal then sends an HTTP 302 response to the UE with a redirect to the originally accessed web page.
25	The PCRF sends an RAR message on the Gx interface to indicate removal of redirection rule.
26	The local P-GW acknowledges the RAR message with an RAA message.
27	The local P-GW removes the L7 redirection rule for the UE session.
28	The local P-GW sends a CCR-U message to PCRF to get the quota information for the authenticated session.
29	The PCRF responds with a CCA-U message with the requested information.
30	UE now attempts to connect to the originally accessed web page again. As the L7 rule is not present at the local P-GW, the packets are sent to the Internet.

Standards Compliance

This feature complies with the following standard(s):

RFC 2866 (RADIUS Accounting)

Configuring RADIUS Accounting-based Session Creation

Enabling RADIUS Accounting-based Session Creation Trigger

Use the following configuration to enable RADIUS Accounting-based session creation:

config 
    context context_name 
        twan-profile profile_name 
            session-trigger radius acct 
            end

Notes:

Use the default session-trigger command to reset the configuration to its default value.
Default: RADIUS (authentication)-based session trigger

Configuring Access Type and UE Address

Use the following configuration to configure the access type and UE address for RADIUS accounting-based session creation:

config 
    context context_name 
        twan-profile profile_name 
            ue-address twan 
            access-type ip 
            end

Notes:

Use the ue-address twan command to enable SaMOG to receive the TWAN UE address through the Accounting Start Framed-IP-Address message.
• Use the access-type ip command to specify that all RADIUS clients under the TWAN profile will use the Layer 3 IP (L3IP) access type.

Monitoring and Troubleshooting RADIUS Accounting-based Session Creation